NIS2 Legislation Status

The NISG 2026 was passed by the Nationalrat on 12 December 2025 and promulgated on 23 December 2025 (BGBl. I No. 94/2025). It entered into force on 1 October 2026, replacing the NISG 2018; risk management and reporting duties have applied since then. Registration and reporting run through the “NIS2 Services” application in the Business Service Portal (USP); the competent authority is the Federal Office for Cybersecurity. Estimates put 4,000 to 5,000 entities across the 18 sectors in scope, with wider figures up to 7,000 depending on how sectors are delimited. The timetable is staged: registration with the competent authority by 31 December 2026 (three months after entry into force), and the self-declaration evidencing implementation of the security measures by 30 September 2027. Austria goes beyond the EU baseline with a broadened scope and tightened organisational and technical duties, backed by a restructured supervisory and sanctions regime. Fines reach up to EUR 10 million or 2 % of global annual turnover for essential entities.

NIS2 transposed via the Act of 26 April 2024; effective at the EU deadline (18 October 2024). CCB enforcement milestone: from 18 April 2026, essential entities must demonstrate full implementation of Article 21 security measures. CCB confirmed incident-triggered investigations are the primary enforcement mechanism; every reported cyber incident at a registered entity can trigger a compliance review. Incident reports rose 70% in 2025 vs 2024. Fines up to EUR 10 million for essential entities.

Bulgaria did not transpose NIS2 on time; it did so only through an amendment to its Cybersecurity Act adopted by the National Assembly on 5 February 2026 (State Gazette No. 17 of 13 February 2026). It extends scope to the directive's 18 sectors, introduces personal management accountability and a 24-hour reporting duty, and applies without a general transition period; a temporary halving of fines expired on 1 June 2026.

Croatia was one of the first member states to transpose NIS2, through the Cybersecurity Act (Zakon o kibernetičkoj sigurnosti, OG 14/2024), in force since 15 February 2024; the supplementary Cybersecurity Regulation has applied since 22 November 2024.

NIS2 transposed through amending Law 60(I)/2025; published on 25 April 2025.

New Cybersecurity Act No. 264/2025 Sb. published 4 August 2025; extends obligations including to the defence sector.

Danish NIS2 Act adopted 29 April 2025; implemented with minimal additions to the EU baseline requirements.

Estonia transposed NIS2 through amendments to its Cybersecurity Act (Küberturvalisuse seadus), passed on 10 December 2025 and in force since 1 January 2026.

Cybersecurity Act 124/2025 implements NIS2 with a focus on clear sector-specific guidance.

The Loi Résilience, which bundles NIS2, the CER Directive and parts of DORA into a single act, has not been promulgated. The Senate adopted it in March 2025, and a special committee of the National Assembly in September 2025. The National Assembly's plenary debate, scheduled for 7 and 9 October 2026, was taken off the agenda again by the Conference of Presidents on 6 October; no new date has been set yet. Until promulgation and the implementing decrees, there is no NIS2 transposition law in force in France and no binding date for registration or reporting duties. Scope is expected to grow from approx. 300 regulated OIV entities to approx. 15,000 entities across 18 sectors, split into Entités Essentielles and Entités Importantes, with ANSSI as the central supervisory authority; a three-year transition to full compliance is envisaged after promulgation. Until then the reference is ANSSI's Référentiel Cyber France (ReCyF) of 17 March 2026. On 8 July 2026 the European Commission referred France to the CJEU for incomplete transposition.

NIS2 Implementation Act (BSIG) in force since 6 December 2025 – no transition period. The registration deadline expired on 6 March 2026, and the final grace period communicated by the BSI on 31 July 2026. According to the BSI's “NIS-2 in Zahlen” statistics, 20,141 entities had registered in the BSI portal as of 30 September 2026, or 20,373 registrations including branch establishments; in August the federal government had cited 19,058 (Bundestag printed paper 21/7573). The government describes the 29,850 affected entities cited in the bill as a Federal Statistical Office estimate based on 2019–2022 data. For the fourth quarter of 2026 the BSI has announced an enforcement initiative against entities that are obviously required to register: it starts with a hearing, not a fine; individual ordered audits are to follow from 2027. Germany's implementation is stricter than the EU baseline.

Greece transposed NIS2 through Law 5160/2024 (Government Gazette A' 195 of 27 November 2024), in force since that day; for municipalities it applies only from 27 November 2026.

Government Decree 418/2024 and Decree 7/2024 implement NIS2 with additional national security provisions. First audit deadline changed from 31 December 2025 to 30 June 2026. Additional subsectors included: public transport, cement manufacturing, electronic communications.

The National Cyber Security Bill is progressing through the Oireachtas but has not been enacted. Enactment is expected during 2026; no binding date has been set, which makes Ireland the least predictable timeline among the EU laggards. On 8 July 2026 the European Commission referred Ireland to the CJEU (alongside France, Spain and the Netherlands) over its failure to transpose NIS2 more than 20 months after the October 2024 deadline. Obligations are nevertheless already reaching Irish firms ahead of the law: in July 2026 Ireland's NCSC published cyber governance guidance for management boards, and NIS2 clauses arrive through customer and supply-chain contracts from member states that have already transposed.

Italy transposed NIS2 through Legislative Decree 138/2024 (in force since 16 October 2024), supervised by the Agenzia per la Cybersicurezza Nazionale (ACN). Entities added to the NIS list in 2025 have had to report significant incidents to CSIRT Italia since January 2026 and must implement ACN's basic security measures within 18 months of being notified of their inclusion – for most, that deadline has passed in October 2026 or runs out by the end of the month; after that ACN can review the state of implementation. On 18 September 2026 ACN updated the list and opened a consultation on reinforced security measures intended to supplement and replace the basic ones. The next registration window runs from 1 January to 28 February 2027.

Latvia was among the early adopters: the National Cybersecurity Law was passed on 20 June 2024 and entered into force on 1 September 2024, replacing the Law on the Security of Information Technologies.

Law on Cybersecurity amended; Lithuania's implementation includes stricter requirements for financial sector.

The Law of 5 May 2026 on cybersecurity measures transposes NIS2 and entered into force on 10 May 2026. Around 2,000 essential and important entities across 18 sectors had to self-register with the Institut Luxembourgeois de Régulation (ILR) by 10 July 2026. Fines reach up to EUR 10 million or 2% of global turnover for essential entities, EUR 7 million or 1.4% for important entities.

Subsidiary Legislation 460.41 (Legal Notice 71/2025) implementing NIS2 entered into force.

The Cyberbeveiligingswet (Cbw) entered into force on 15 August 2026, replacing the earlier Wbni, together with the Wet weerbaarheid kritieke entiteiten (Wwke) transposing the CER Directive. Around 8,000 organisations across 18 sectors are in scope, split into essential and important entities with tiered obligations. There is no transition period: registration via the NCSC portal mijn.ncsc.nl, the duty of care (zorgplicht) and the three-stage reporting process (24-hour early warning, 72-hour notification, 1-month final report) all apply from day one. Board members are personally liable; fines reach up to EUR 10 million or 2 % of global annual turnover for essential entities. The NCSC is the central point of contact and CSIRT, while supervision sits with the sectoral authorities — for digital infrastructure and digital services the Rijksinspectie Digitale Infrastructuur (RDI). The European Commission referred the Netherlands to the CJEU on 8 July 2026 over the transposition delay; entry into force removes the grounds for the action, but formal withdrawal is still outstanding.

The amendment of 23 January 2026 to the National Cybersecurity System Act (KSC Act, Dz.U. 2026 item 252) transposes NIS2 and entered into force on 3 April 2026; the President at the same time referred it to the Constitutional Tribunal for subsequent review. The deadline for applying via the S46 system for entry in the list of essential and important entities expired on 3 October 2026; entities that meet the criteria later have six months to do so. The security obligations must be implemented by 3 April 2027.

Decree-Law 125/2025 — adopted under the enabling Lei 59/2025 — was published on 4 December 2025 and entered into force 120 days later, on 3 April 2026, establishing Portugal's new cybersecurity legal framework and transposing NIS2 into national law.

Romania transposed NIS2 through Emergency Ordinance OUG 155/2024, published in Official Gazette No. 1332 of 31 December 2024 and in force the same day. Parliament approved it with amendments through Law 124/2025 (in force since 10 July 2025). The competent authority is the National Cyber Security Directorate (DNSC).

Act No. 69/2018 Coll. on Cybersecurity amended to implement NIS2; stricter requirements for some sectors.

Slovenia transposed NIS2 through the Information Security Act ZInfV-1, adopted on 23 May 2025 and in force since 19 June 2025. Entities in scope had to self-register by 19 December 2025.

Spain has still not transposed NIS2. The Anteproyecto de Ley de Coordinación y Gobernanza de la Ciberseguridad was approved by the Council of Ministers as long ago as 14 January 2025, but by September 2026 it had neither passed its second reading in the Council of Ministers nor reached the Cortes; nothing has been published in the Boletín Oficial del Estado. Until a transposition law is in force, Spanish entities remain governed by the NIS1 regime under Real Decreto-ley 12/2018. The draft follows the directive closely: all 18 sectors, EU-standard thresholds (50+ employees or EUR 10 million turnover), split supervision between INCIBE-CERT for the private sector and CCN-CERT for public entities and critical infrastructure, and fines of up to EUR 10 million or 2 % of global turnover for essential entities. On 8 July 2026 the European Commission referred Spain – together with France, Ireland and the Netherlands – to the CJEU for incomplete transposition and requested financial penalties.

Cybersäkerhetslagen (2025:1506) entered into force on 15 January 2026, replacing the 2018 NIS-implementing act. Roughly 8,000 organisations across 18 sectors fall into scope; notification and self-assessment obligations under MSB (via NCSC-SE) became applicable on 2 February 2026. Sanctions follow the EU maximums: up to EUR 10 million or 2% of global turnover for essential entities, EUR 7 million or 1.4% for important entities. Sweden's transposition stays close to the EU baseline.